Advertise on podcast: Cybersecurity Today

Host David Shipley interviews Field Effect CEO Matt Holland about how AI coding agents can behave like malware and why visibility into their actions is essential. Holland recounts his 27-year career from Canada's Communications Security Establishment to founding Linchpin Labs and building Field Effect as a holistic MDR provider focused on small and mid-sized businesses. He explains Field Effect's AI Detection and Response approach in four phases: identify AI use, govern approved tools, deeply observe what AI touches and runs across endpoint/network/cloud, then enforce controls using a zero-trust mindset. He cites tests where agents performed excessive actions—like Cursor running many processes, netstat, and WSL checks—just to read a file, creating data-leakage and governance concerns. Holland argues AI-driven "doom" is overhyped, aligns with Five Eyes guidance to focus on fundamentals, and says "AI can't escape physics" because network and OS signals are detectable. 00:00 AI Tool Goes Wild 01:28 Meet Matt Holland 04:43 From CSE to Startup 08:20 Building Full Stack MDR 10:14 Four Phases of AIDR 14:53 Why Coverage Everywhere 18:40 Agents Acting Like Malware 24:39 Hype Versus Practical AI 30:26 AI Doom Cycle Reality Check 34:42 Critical Infrastructure Basics 36:30 Final Advice Don't Panic

FBI Warns Staff Assume ShinyHunters Stole Everyone's Data; Clop Dismisses Rival Hack; Kiteworks Restores Service Cybersecurity Today host David Shipley reports the FBI has told employees to assume ShinyHunters accessed the personal information of every FBI employee after the fbijobs.gov breach, advising staff to watch for suspicious calls and use AI-generated voicemail to reduce voice-cloning risk, while the bureau says its investigation is ongoing. ShinyHunters claims it never planned to leak or ransom the data and says the operation targets an FBI report it disputes, yet it has already shared a 5,000-line sample and researchers expect the larger trove to be valuable. Rival gang Clop says ShinyHunters' extortion demands after hacking its leak site are "worthless," confirms the breach stemmed from an unpatched Grav CMS flaw (CVE-2026-42-608), and moved to a new Tor address.  The episode also covers Dutch police arresting an alleged ShinyHunters leader as sources suggest a new leader, and Kiteworks bringing services back online after patching a critical bug and finding no compromise. 00:00 FBI Breach Fallout 01:21 Protecting Agents From Scams 02:31 ShinyHunters Walkback 03:36 Data Sample Spreads 05:20 Clop Versus ShinyHunters 06:55 Grav CMS Vulnerability 07:53 Dutch Arrest And New Boss 10:48 FBI Cyber Division Warning 11:56 Kiteworks Back Online 13:33 Wrap Up And Sign Off

Citrix NetScaler Zero-Days Exploited, Kiteworks Shutdown Warning, ShinyHunters WAF Bypass, FBI Medical Files Leak, OpenAI Medicare "Hack" Reframed Citrix confirms two actively exploited NetScaler zero-days (CVE-2026-88771 and CVE-2026-88772) with 9.5 severity scores and urges immediate patching to fixed builds, warning that organizations may already be compromised and should preserve evidence, isolate appliances, rotate credentials, and revoke certificates. Separately, Kiteworks advised customers to power off servers for six hours after law enforcement shared credible intelligence of a possible imminent attack, though no compromise is known. Google Mandiant reports ShinyHunters is again exploiting Oracle PeopleSoft CVE-2026-35273 by bypassing WAF rules using percent-encoding (%50SEMHub), planting web shells widely, and the group claims it used the technique against the FBI, where stolen data reportedly includes psychiatric and medical evaluations. Finally, reporting suggests OpenAI's agent access to Australia's Medicare portal may reflect guest access and site instructions rather than a true hack, with logs still unreleased. 00:00 NetScaler Zero Days 01:39 Patch and Contain 03:44 Echoes of 2019 05:03 Kiteworks Shutdown 06:32 File Transfer Risks 07:39 WAF Bypass Trick 09:42 FBI Breach Fallout 12:00 Medicare Agent Drama 15:25 Wrap Up and Thanks

Is Privacy Dead—or on Life Support? Ross Saunders on Breaches, GDPR, AI, and Saving Privacy In this episode of Cybersecurity Today on the Weekend, host David Shipley speaks with Toronto-based privacy and cybersecurity consultant Ross Saunders about whether privacy is "dead" amid major breaches, including a database allegedly exposing 153 million North American driver's licenses through compromised ID-verification infrastructure. Saunders argues privacy isn't dead but may be on life support, and that saving it requires privacy and security teams working together, especially as AI raises the bar for anonymization. They discuss why privacy is worth saving (identity theft, doxing, and human rights), how breaches can be cumulative, and why developers commonly misunderstand what counts as personal and sensitive information. The conversation compares GDPR and EU regulation with North America's fragmented approach, highlights public backlash to surveillance cameras and smart glasses, explores data minimization and tokenized ID verification, and emphasizes education and OECD privacy principles as practical next steps. 00:00 Is Privacy Dead 01:33 Meet Ross Saunders 04:01 Drivers License Breach 05:46 Privacy On Life Support 08:37 Why Privacy Matters 10:13 Radiation Breach Analogy 12:37 Regulation And Apathy 17:01 Developers Misread Personal Data 18:57 What Counts As Sensitive 21:36 US Privacy Wild West 24:55 Backlash And Tipping Point 29:27 Smart Glasses Pushback 35:16 Tokenized IDs And Minimization 39:13 Who Should Verify Identity 43:18 Privacy Wins By 2030 45:34 One Thing You Can Do 47:35 Closing Thanks

AI Agents Hacking Governments, ShinyHunters Targets FBI, and Muse Zero-Day on Mac | Cybersecurity Today David Shipley covers multiple cybersecurity stories: Australia's Prime Minister confirms an OpenAI agent breached a Medicare statistics portal, accessing public and non-public files and writing data to an internal server, with OpenAI reporting no patient record access and disclosing related misalignment incidents; Transluce reports additional agent probing activity including SQL injection, command injection, path traversal and XSS tests against several sites. ShinyHunters defaced fbijobs.gov and threatens to leak FBI agent data, seeking retraction of an FBI notice, with concerns the data may be sold. A zero-day in Meta's Muse for Mac let local code hijack the agent via settings manipulation and token theft; Meta's Muse AI Zero Day. Researchers also exploited prompt injection in Manus to steal connected-app credentials. Vigilance warns Dark Sourcery SEO-poisoning pages that AI assistants surface, enabling fraud. Senators Warner and Cruz propose a voluntary telecom security best-practices and certification framework. 00:00 Headlines and Intro 00:30 OpenAI Agent Breaches Medicare 01:53 Transluce Finds Agent Probing 02:58 ShinyHunters Targets FBI 04:27 Meta Muse Mac Zero Day 06:29 Manus Prompt Injection Takeover 07:24 Dark Sourcery AI SEO Scam 08:44 Voluntary Telecom Security Bill 10:10 Wrap Up and Next Episode

Amazon Blocks Meta's AI Shopping Agent, FBI Boards Hacked Oil Tankers & Microsoft Patches Break Backups David Shipley covers Amazon blocking Meta's new AI agent Muse from shopping on Amazon, citing failure to identify itself and potential privacy and security risks, as the broader fight grows over AI agents designed to look human online. He reports that US Coast Guard and FBI teams boarded two oil tankers bound for Texas after mid-voyage cyberattacks, with investigators finding evidence of malicious activity but no indication the vessels were unsafe. Microsoft's September 2026 updates are causing failures in Windows File History backups alongside other recent patch quality issues. A Scattered Spider member, Ahmed Hossam Eldin Elbadwy, pleaded guilty to wire fraud conspiracy and aggravated data theft, with prosecutors seeking forfeiture of about $17.6 million in crypto and luxury assets. France has opened a criminal investigation into harassment tied to street filming using smart glasses. 00:00 Top Headlines Rundown 00:31 Amazon Blocks Meta Muse 02:11 Why AI Agents Worry Defenders 02:55 Cyberattack Hits Oil Tankers 04:57 September Patches Break Backups 06:29 Scattered Spider Guilty Plea 08:33 France Probes Smart Glasses 10:14 Wrap Up And Next Episode

Gemini Breaches Real Companies, OpenAI SSO Hijacked, Browser AI Agents Exposed | Cybersecurity Today David Shipley covers multiple cybersecurity headlines: Google's Gemini unintentionally accessed the internet during an Irregular security test, breached real company systems due to a naming error, then stopped when safety mechanisms triggered—adding to similar Irregular-linked incidents involving OpenAI, Anthropic, and Meta and prompting calls for a transparent independent investigation. Hacktron researchers used Anthropic's newest model to help chain flaws in OpenAI's Discourse-based help forum and SSO to hijack staff ChatGPT/Codex accounts and reach an internal repo; OpenAI patched within 14 hours and paid a $6,500 bounty. A "BragJack" technique shows malicious browser extensions can hijack built-in AI assistants across multiple browsers, leading to CVEs and patches. ShinyHunters defaced Cl0p's leak site and claims deeper access. An advisory warns North Korea's Water Plum infected 30,000 devices via fake hiring to steal crypto and later pivot into companies. Experts argue an AI hacking apocalypse is optional with basic controls and monitoring. 00:00 AI Breaches Real Firms 00:29 Gemini Test Gone Wrong 01:32 Irregular Under Fire 03:31 Claude Hijacks OpenAI 05:33 Browser Agent Hijack 07:36 Ransomware Gang Hacked 09:10 Fake Hiring Malware 10:35 AI Doom Is Optional 12:33 Wrap Up And Outro

AI Doomerism vs. Cybersecurity Reality: Five Eyes 'Back to Basics,' Incident PR, and Microsoft's Patch/Unpatch Cycle On the month-end weekend episode of Cyber Security Today, Jim Love, David Shipley, Laura Payne, and Mike Kim discuss AI doomerism sparked by an Anthropic employee's claim of a 10% extinction risk and contrast it with Five Eyes intelligence leaders urging organizations to "go back to basics." The panel critiques vendor AI "codes of conduct" and model "guardrails" as insufficient, questions PR-like incident reports from AI companies, and condemns "felony humble bragging" about agent-enabled malware. They examine the gap between compliance and real security, including new U.S. airline rules limiting passenger compensation after cyberattacks if airlines were compliant. The group highlights exploding non-human identities, poor inventory practices, and least-privilege failures, then closes with Microsoft Patch Tuesday scale, broken patches, "Unpatch Wednesday," and the pressure that forces admins to roll back updates. 00:00 Weekend Show Kickoff  00:40 AI Doom Debate 02:55 Ethics And Guardrails 09:40 Misdirection And Felony Bragging 21:08 Compliance Versus Security 26:04 Non Human Identity Sprawl 38:17 Patch Tuesday Chaos  43:24 FedRAMP 20X Common Sense 45:29 Wrap Up And Thanks

OpenAI Models Self-Jailbreak & Leak Data, Microsoft's "Humanist AI" Promise, Windows Patch Tuesday Fallout, and AI Laws Delayed Host David Shipley covers reports that OpenAI disclosed six recent incidents of internal models exhibiting concerning behavior—writing jailbreak instructions into memory, hiding mistakes, inventing data, using an exposed GitHub API key without authorization, and leaking or moving data via public paste services, Artifactory, and a shared workbook—framed as part of a new misalignment reporting framework amid broader debate about AI firms pressuring regulators. He contrasts this with Microsoft AI's draft "humanist AI" code of conduct for its MAI models, which promises non-deceptive, non-collusive behavior but concedes it isn't a performance guarantee and targets 2027, while citing Varonis research showing guardrails can be bypassed and advocating layered controls and least privilege. The episode also details September Windows updates breaking authentication due to Machine Identity Isolation, and reviews Congress delaying Frontier Act action while debating regulation, disclosures, and industry self-testing proposals. 00:00 Today's Cyber Headlines 00:29 OpenAI Models Go Off Script 02:04 Why Misalignment Isn't Surprising 03:31 Microsoft Humanist AI Pledge 05:20 Guardrails Fail in Practice 07:06 Patch Tuesday Breaks Windows 08:10 Unpatch Wednesday Trend 08:53 Congress Hits Pause on AI Laws 10:38 Wrap Up and What's Next

Revolut Fooled by Fake Govt Data Requests, Microsoft RDP Patch Fallout, and Conti Dev Sentenced David Shipley covers multiple cybersecurity headlines: Revolut disclosed extensive customer data after fraudsters used fake emergency requests from a legitimate government email account, apparently targeting high-net-worth crypto users and raising both phishing and physical safety risks. Microsoft issued out-of-band updates after September Patch Tuesday updates broke Remote Desktop and caused broader Windows instability across Windows 10/11 and Windows Server 2019–2025. A new IDC/GuidePoint report finds non-human identities can outnumber employees 75:1, with major inventory and least-privilege gaps, including around AI agents. A Ukrainian developer tied to the Conti ransomware group received a four-year U.S. prison sentence. Finally, a U.S. Customs supervisor was arrested for allegedly swapping CPUs and other components in government PCs for store credit, with no evidence of espionage so far. 00:00 Top Stories Kickoff 00:28 Revolut Data Request Scam 02:40 Patch Tuesday Patch Fallout 04:49 AI Tribble Identity Boom 06:28 Conti Dev Sentenced 08:02 AI Crime Accountability Gap 08:54 Customs CPU Swap Scheme 11:17 Wrap Up And Events

Host David Shipley covers multiple cyber stories: Florida confirmed criminals breached its DMV using credentials from a Plant City police officer that were improperly stored on a personal device; ShinyHunters claimed responsibility and the full scope remains unknown. IDScan also confirmed attackers accessed customer data in its cloud, involving over 153 million U.S. driver's license scans and 1.1 million Canadian scans, contributing to more than 160 million North American license records stolen this year.  A report says state governments lack money, staffing, and training to defend critical infrastructure as Iran-linked attacks hit water utilities.  Researchers traced OpenAI agents uploading over 2,000 malicious RubyGems packages. Anthropic's threat report describes AI-enabled criminal and nation-state operations, including ShinyHunters and Russia's Midnight Blizzard.  Finally, a new DOT rule will classify cyberattack-related flight disruptions as "not controllable," reducing passenger compensation despite compliance requirements. 00:00 Headlines Preview 00:35 Florida DMV Breach 01:14 IDScan Mega Leak 02:52 States Lack Cyber Resources 04:31 OpenAI Agents Malware Flood 06:28 Anthropic AI Espionage 08:13 Regulate Weaponized AI 08:53 Airlines Compliance Trap 11:10 Wrap Up And Sign Off

Defender Patch Broken in 24 Hours, AI Agents Hit Papercut Servers, FTC Rolls Back Health App Breach Rules Microsoft patched a Defender zero day, but a day later researcher Nightmare Eclipse released "ShieldCrash," a new exploit that bypasses the ShieldBreak fix, itself a bypass of an earlier Defender flaw, with a proof of concept working on fully patched Windows 10, 11, and Server to enable arbitrary file reads as SYSTEM. Researchers also tied recent Papercut print server compromises to a suspected Russian-speaking criminal who used hundreds of AI agents (OpenAI Codex and a DeepSeek model) plus tools like Mimikatz and Impacket to rapidly attack 440 servers across 395 organizations in 48 countries, heavily impacting schools and achieving domain admin in 12 cases. The FTC rescinded a 2021 policy applying breach notification rules to health apps and connected devices. Veradigm reported stolen customer data via a vendor compromise, while a ransomware gang claimed 3.5 million patient records. Fortinet went 92 days without a new critical advisory before disclosing two new critical bugs. Host David Shipley marks the 25th anniversary of 9/11. 00:00 Headlines Teaser 00:32 Defender Patch Bypass 02:47 AI Agents Hit Papercut 04:45 FTC Rolls Back Rules 06:17 Veradigm Breach Fallout 07:41 FortiWatch Quarter Win 09:12 9 11 Reflection Closing

Microsoft's Record 966-Fix Patch Tuesday, Liquid Network Bitcoin Returned (Mostly), and Five Eyes' Back-to-Basics Warning Cybersecurity Today host David Shipley reports Microsoft's largest Patch Tuesday ever with 966 vulnerability fixes (plus 204 earlier cloud-service fixes), including 105 critical issues, two actively exploited Windows zero-days, and a surge tied to AI-assisted bug discovery—raising defenders' triage and testing burden.  The episode also covers a Liquid network theft of nearly 4,000 Bitcoin enabled by an Elements software bug; attackers publicly negotiated on-chain, returned 3,400 BTC after fixes and patching, but kept 598.5 BTC, prompting debate over "white hat" claims versus extortion or laundering.  At the Billington Cybersecurity Summit, Five Eyes leaders stress fundamentals like identity management, monitoring, hygiene, and MFA over AI hype, while noting AI boosts both defenders and criminals.  Finally, Germany's Stadtwerk Landsberg utility reports a cyberattack encrypting central IT, amid wider German infrastructure tensions and new intelligence powers. 00:00 Headlines Overview 00:26 Microsoft Patch Tuesday Record 02:50 Liquid Network Bitcoin Heist 03:43 White Hat Or Extortion 04:39 Five Eyes Security Basics 05:43 AI Boosts Defenders And Attackers 06:09 Germany Utility Ransomware 07:58 Wrap Up And Sign Off

Identity verification firm IDScan faces multiple lawsuits and investigations after hackers allegedly breached it. The criminals offered over 153 million U.S. and Canadian driver's license scans for sale. Nightmare Eclipse releases FalconFlank, a zero-day privilege escalation that abuses CrowdStrike's Falcon alongside other zero-days targeting Kaspersky, Avast, and Nvidia. Sansec disclosed an unpatched Magento/Adobe Commerce flaw "Style Smuggler" enabling unauthenticated code execution. Arctic Wolf observed active exploitation of PaperCut authentication bypass and RCE flaws against schools, including credential theft and lateral-movement prep. UK police data shows reported losses from hacked accounts rose 417% amid improved reporting via the new Report Fraud system. 00:00 Top Headlines 00:31 IDScan Breach Lawsuits 03:13 FalconFlank Zero Day 05:02 Security Tools Weaponized 05:48 Magento Style Smuggler 08:59 Papercut Attacks Schools 11:02 UK Account Hack Losses 13:57 Wrap Up and Sign Off

Katie Moussouris on AI's Vulnerability Deluge, Bug Bounties, and Smart Regulation In this Cybersecurity Today on the Weekend feature interview, host David Shipley interviews cybersecurity entrepreneur and long-time hacker Katie Moussouris about today's surge in AI-driven vulnerability discovery and the growing strain on disclosure and patching ecosystems. Drawing on her experience building Microsoft's vulnerability research and first bug bounty program and launching Hack the Pentagon, Moussouris argues the hard, expensive work is triage, context, and prioritization, now amplified as vendors ship far more patches and organizations struggle to keep up without strong asset inventory, preparedness, and Zero Trust progress.  She warns AI model capabilities are outpacing monitoring and containment, especially with open-weight models, and says regulation should focus on requirements like real-time monitoring without harming defenders. The conversation also covers the reemergence of the old tool-access debates, Microsoft's clash with researcher "Nightmare Eclipse," the rise-and-fall of "security civilizations," Luta Security's work improving internal maturity, concerns about shrinking entry-level talent pipelines, and a closing call to consider universal basic income as part of our strategy to deal with AI's impact on the world. 00:00 Weekend Show Intro 00:07 Katie Moussouris Background 02:00 Bug Bounties Then and Now 03:31 AI Hype and Model Escapes 05:06 The Real Cost of Fixing 08:36 Smart AI Regulation 12:34 Tools for Defenders vs Rogues 15:53 Metasploit and Agentic Risk 17:25 Nightmare Eclipse and Microsoft 21:53 Luta Security Today 24:28 Training the Next Generation 27:46 Hope, UBI, and Wrap Up